Enrich AD users from SGU profile metadata

src/SGU.AuthBroker/Options/BrokerOptions.cs

@@ -36,6 +36,27 @@ public sealed class BrokerOptions
             throw new InvalidOperationException("NTLM timeout or redirect limits are outside the supported range.");
         }
 
+        if (Ntlm.MaxProfileBytes is < 32 * 1024 or > 2 * 1024 * 1024)
+        {
+            throw new InvalidOperationException("The SGU profile response limit is outside the supported range.");
+        }
+
+        foreach (string profilePath in new[] { Ntlm.AdministrativeProfilePath, Ntlm.MenuProfilePath })
+        {
+            if (string.IsNullOrWhiteSpace(profilePath))
+            {
+                throw new InvalidOperationException("SGU profile paths are required.");
+            }
+
+            Uri profileUri = new(endpoint, profilePath);
+            if (profileUri.Scheme != Uri.UriSchemeHttps ||
+                !string.IsNullOrEmpty(profileUri.UserInfo) ||
+                !Ntlm.AllowedRedirectHosts.Contains(profileUri.IdnHost, StringComparer.OrdinalIgnoreCase))
+            {
+                throw new InvalidOperationException("SGU profile paths must resolve to an allowed HTTPS host.");
+            }
+        }
+
         if (string.IsNullOrWhiteSpace(Directory.LdapHost) ||
             string.IsNullOrWhiteSpace(Directory.BaseDn) ||
             string.IsNullOrWhiteSpace(Directory.DomainNetbios) ||
@@ -83,6 +104,13 @@ public sealed class NtlmOptions
 
     public int MaxRedirects { get; init; } = 5;
 
+    public string AdministrativeProfilePath { get; init; } =
+        "/psulsa/gadmon/capitalhumano/controlincidencias/incidencias.aspx";
+
+    public string MenuProfilePath { get; init; } = "/psulsa/menu.aspx";
+
+    public int MaxProfileBytes { get; init; } = 512 * 1024;
+
     public string[] AllowedRedirectHosts { get; init; } = ["sgu.ulsa.edu.mx"];
 }